GF Scanner - Gluten Free — Privacy Policy

Effective Date: August 15, 2026

GF Scanner - Gluten Free ("the App") is developed by Mobile Card Games & Travel Apps LLC. This Privacy Policy covers both the iOS version of the App distributed on the Apple App Store and the Android version distributed on Google Play. It explains what data the App collects, how it is used, and how your privacy is protected. Where the two versions differ, the difference is called out explicitly.

1. Data We Collect

GF Scanner collects the following data that you provide directly through your actions in the App:

• Photos of food and ingredient labels: Photos you take with your camera or select from your photo library to have their ingredients analyzed for gluten.
• Ingredient text: Ingredient lists you scan or type in for analysis.
• Barcode numbers: The numeric barcode (UPC/EAN) of products you scan.
• Your safety profile: The sensitivity setting you choose, stored on your device.
• Purchase information: Transaction records for in-app subscriptions, managed by Apple (iOS) or Google Play (Android) together with RevenueCat.

The App does not collect your name, email address, location, contacts, or advertising identifiers, and it serves no ads. The iOS App contains no analytics SDKs and does not request the iOS App Tracking Transparency permission because it does not track you. The Android App includes Google Firebase, whose analytics component collects aggregate app-usage statistics and device information (such as device model and app version) to help us understand overall usage; advertising-ID collection is disabled and this data is never used for advertising.

2. How We Use Your Data

Your data is used solely to tell you whether a product contains gluten:

• When you photograph or select a label image, the photo is sent to an AI model for ingredient and gluten analysis — on iOS to OpenAI, and on Android to Google's Gemini model via Firebase. The same applies to ingredient text you scan or type.
• Reading text off a label happens on your device (Apple's Vision framework on iOS, Google's ML Kit on Android); the photo itself leaves your device only to perform the AI analysis described above.
• When you scan a barcode, the barcode is detected on your device and only the numeric barcode is sent to Open Food Facts, a public food-product database, to look up the product and its ingredients. No photo or identity data is included in that request.
• The analysis result (gluten status, risk level, detected ingredients, recommendations) is shown to you and saved as text in your on-device scan history.

3. Consumer Health Data

Some laws treat information about your health that an app handles — “consumer health data” — with special care. In plain terms, here is where this App stands:

• What health-related data the App handles: your gluten-sensitivity setting and the content of your scans — label photos, ingredient text, barcodes, and the resulting gluten analyses — which together may reflect a dietary or medical need to avoid gluten.
• Where it lives: your sensitivity setting and scan history are stored only on your device. They are never sold or shared and never used for advertising.
• Processing in transit: a label photo or ingredient text is sent to the AI analysis service — OpenAI (via the AIProxy relay) on iOS, or Google's Gemini model (via Firebase) on Android — solely to perform the gluten analysis and exists in transit only; a scanned barcode number is sent to Open Food Facts to look up the product. Neither request includes your identity.
• Your choices: clear your scan history and settings in the App, or uninstall the App to delete everything on the device. For questions or to exercise any right over health data, contact us at the email below.

4. Third-Party Data Sharing

Your data is shared only with the services needed to perform a scan:

• OpenAI (openai.com) — iOS only: Receives the photo or ingredient text you submit to perform the gluten analysis. Data is transmitted through AIProxy (aiproxy.com), a secure API relay, over an encrypted HTTPS connection. Per OpenAI's API data usage policies, data sent through the API is not used to train their models.
• Google (policies.google.com/privacy) — Android only: Google's Gemini model receives the photo or ingredient text you submit to perform the gluten analysis, transmitted via Firebase over an encrypted HTTPS connection; no API key ships in the App. Google Firebase also collects the aggregate usage analytics described above.
• Open Food Facts (world.openfoodfacts.org): Receives only the numeric barcode you scan. The request identifies the App (not you) via a standard User-Agent header.
• Apple, Google Play, and RevenueCat (revenuecat.com): Purchases are processed by Apple on iOS and by Google Play on Android; the App never sees your payment card details. RevenueCat receives purchase transaction tokens and a random anonymous app-user ID — never your name or email.

We do not sell, rent, or share your data with anyone else.

Abuse prevention (iOS): every AI request the iOS App sends also includes your device's Apple identifier-for-vendor and an Apple DeviceCheck token. These are used solely to prevent abuse and rate-limit AI requests; they are not linked to your name or identity and are not used for advertising or tracking.

5. Data Storage and Retention

• On your device: Your scan history is stored locally as text (scan results, counters, timestamps) — the photos themselves are not saved by the App after analysis. Your safety profile, free-scan counter, and a short-lived (24-hour) cache of barcode lookups are also stored locally.
• Device backups: Your device's standard backup service (iCloud Backup on iOS, Google's Android Backup on Android) may include the App's local data in your encrypted device backup; we cannot access those backups.
• On our servers: We do not operate any server that stores your data. Photos and ingredient text exist in transit only during the AI analysis request.
• Deletion: You can clear your scan history in the App at any time; uninstalling the App removes all locally stored data.

6. Data Security

All network requests are made over encrypted HTTPS connections. On iOS, AI requests are routed through AIProxy so that API keys are protected and never embedded directly in the App; on Android, AI requests are routed through Firebase, so no API key ships in the App.

7. Your Rights

You have the right to:

• Clear your scan history and settings in the App at any time, or remove all App data by uninstalling the App.
• Deny camera or photo access, which prevents the App from accessing your camera or photos; barcode scanning also requires camera access. Permissions can be changed at any time in your device's Settings.

Depending on where you live, privacy laws such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) give you rights over your personal data, including the rights to know, access, correct, and delete it. Because we do not hold your data on servers we operate, there is typically nothing for us to access or delete on request — deleting the App deletes your data. Where the App does process data in transit, or a third-party service described above collects data, you may contact us at the email below to exercise your rights, and we will respond as required by applicable law.

8. Children's Privacy

The App is not directed at children under 13, and we do not knowingly collect data from children under 13. In some regions, including the European Union, a higher minimum age applies to consent for data processing; the same statement applies there — we do not knowingly collect data from anyone under the applicable age.

9. Data Breach Notification

In the unlikely event of a data breach affecting user data on any system we operate, we will notify affected users as required by applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Effective Date" at the top of this page.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at:

v5cqpsj4e3u4@opayq.com